Security Reviewer
Jeffallan/claude-skills
Audits code and infrastructure for vulnerabilities and produces a severity-rated report with locations and remediation, using SAST, dependency and secrets scans plus manual review.
Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults.
Install Security Audit
$ npx skills add Aedelon/claude-code-blueprint --skill security-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Aedelon/claude-code-blueprint security-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Aedelon/claude-code-blueprint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/security-audit .claude/skills/security-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-audit" agent skill from https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-audit into .claude/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Aedelon/claude-code-blueprint --skill security-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Aedelon/claude-code-blueprint security-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Aedelon/claude-code-blueprint.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/security-audit .agents/skills/security-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-audit" agent skill from https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-audit into .agents/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Aedelon/claude-code-blueprint --skill security-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Aedelon/claude-code-blueprint security-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Aedelon/claude-code-blueprint.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/security-audit .cursor/skills/security-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-audit" agent skill from https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-audit into .cursor/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Aedelon/claude-code-blueprint.git --path skills/security-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Aedelon/claude-code-blueprint --skill security-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Aedelon/claude-code-blueprint security-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Aedelon/claude-code-blueprint.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/security-audit .gemini/skills/security-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-audit" agent skill from https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-audit into .gemini/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Aedelon/claude-code-blueprint security-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Aedelon/claude-code-blueprint --skill security-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Aedelon/claude-code-blueprint.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/security-audit .github/skills/security-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-audit" agent skill from https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-audit into .github/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Aedelon/claude-code-blueprint --skill security-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Aedelon/claude-code-blueprint security-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Aedelon/claude-code-blueprint.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/security-audit .opencode/skills/security-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-audit" agent skill from https://github.com/Aedelon/claude-code-blueprint/tree/main/skills/security-audit into .opencode/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-audit- GitHub stars
- 120
- Token cost
- ~1.6k tokens
- SKILL.md length
- 347 words
- Files
- 1
- Skills in repo
- 8
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults.
- Works in 4 steps: Automated Scans → Manual Review → Classify Findings → …
- Mentions: security
- SKILL.md covers Overview, Process, Phase 1: Automated Scans and Phase 2: Manual Review, plus 3 more sections
- Calls npm, uv and cargo
What it does
Security Audit is an agent skill from Aedelon/claude-code-blueprint. Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults. MUST BE USED when user mentions: "security", "vulnerability", "audit", "OWASP", "CVE", "security review", "pentest", "injection", "XSS", "CSRF", "authentication", "authorization", "secrets", "hardcoded password", "secure", "npm audit", "pip-audit", "check security", "is this secure", "security risk", "data leak", "SQL injection", "command injection", "path traversal"…
Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Web application vulnerabilities, Security review and Vulnerability scanning. It works with Semgrep, Snyk, Trivy and SQL. The repository describes itself as: Production-grade Claude Code configuration: skills, agents, hooks, rules, and permissions working as a system.
When your agent uses it
- Mentions: security
- Security review
- Hardcoded password
- Command injection
Example prompts
- “security”
- “vulnerability”
- “security review”
- “/security-audit”
Requirements
- Python 3
- Pre-approved tools (allowed-tools): Read, Grep, Glob, Bash, WebSearch, WebFetch, Agent
Workflow steps
4 steps, taken from the step headings in SKILL.md.
- Automated Scans
- Manual Review
- Classify Findings
- Report
What it can do on your machine
Read from SKILL.md and the folder at commit 3bb5099. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
ReadGrepGlobBashWebSearchWebFetchAgent
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npmuvcargo
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm and uv, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Audit loads about 1.6k tokens when it runs. Until then it costs about 205 tokens; SKILL.md has 347 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:66
- .env files: verify .env is listed in .gitignore - NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
allowed-tools: Read, Grep, Glob, Bash, WebSearch, WebFetch, Agent
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 347 words (~1,587 tokens).
“Systematic security review covering OWASP Top 10, dependency vulnerabilities, secrets, and secure patterns.”
- name
- security-audit
- allowed-tools
- Read, Grep, Glob, Bash, WebSearch, WebFetch, Agent
Files
Just SKILL.md in skills/security-audit of Aedelon/claude-code-blueprint.
Open the folder on GitHubat commit 3bb5099
Compare with similar skills
Security Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Audit this skillAedelon/claude-code-blueprint | 120 | — | ~1.6k | Automated safety check: Notes | Custom licence | |
| Security ReviewerJeffallan/claude-skills | 12k | — | ~1.3k | Automated safety check: Pass | MIT | |
| Security Auditstaruhub/ClaudeSkills | 727 | — | ~1.3k | Automated safety check: Notes | MIT | |
| Security Scanericrisco/rsc-harness | 167 | — | ~2.8k | Automated safety check: Notes | MIT | |
| Security Auditoreigent-ai/eigent | 15k | — | ~1.8k | Automated safety check: Notes | Apache-2.0 | |
| Code Audit3stoneBrother/code-audit | 893 | 1 repos | ~2.7k | Automated safety check: Pass | None |
Similar skills
Security Audit
staruhub/ClaudeSkills
全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描 -…
Security Scan
ericrisco/rsc-harness
A skill your agent uses when automated scanners drive a security sweep of a repo or app — SAST, dependency/lockfile CVEs, secrets in the tree or git history, IaC misconfig — and the raw output has…
Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
More from Aedelon/claude-code-blueprint
All 8 skills in this repoAnti Hallucination
Aedelon/claude-code-blueprint
CRITICAL SAFETY SKILL — Verify ALL technical claims, API signatures, library methods, code behavior, and factual statements before answering.
Brainstorm
Aedelon/claude-code-blueprint
Multi-agent brainstorming and strategic thinking on any complex topic.
Code Patterns
Aedelon/claude-code-blueprint
Reference patterns for REST APIs, pytest/vitest testing, Docker multi-stage builds, GitHub Actions CI/CD, PostgreSQL, TypeScript generics, Python async, and React Server Components.
Commit Message
Aedelon/claude-code-blueprint
Ship workflow: review changes, generate conventional commit messages, push, and create PRs.
Core Protocols
Aedelon/claude-code-blueprint
Debug errors systematically by searching first, then analyzing, then proposing verified solutions.
Research Protocol
Aedelon/claude-code-blueprint
Conduct rigorous research with proper citations (DOI, arXiv, PMID) and source triangulation.
Related
Categories
Questions about Security Audit
What does Security Audit do?
Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults. Security Audit is an agent skill from Aedelon/claude-code-blueprint. Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults.
When should I use Security Audit?
Security Audit fits situations like: mentions: security; security review; hardcoded password; command injection.
How do I install Security Audit in Claude Code?
Run `npx skills add Aedelon/claude-code-blueprint --skill security-audit -a claude-code`. Or copy the skill folder (skills/security-audit in Aedelon/claude-code-blueprint) into .claude/skills/security-audit in your project. Claude Code loads it when a task matches its description.
How do I install Security Audit in Codex?
Run `npx skills add Aedelon/claude-code-blueprint --skill security-audit -a codex`. Or copy the skill folder (skills/security-audit in Aedelon/claude-code-blueprint) into .agents/skills/security-audit in your project. Codex loads it when a task matches its description.
Can I use Security Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Aedelon/claude-code-blueprint --skill security-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-audit, .gemini/skills/security-audit, .github/skills/security-audit and .opencode/skills/security-audit in your project.
What does Security Audit need to run?
Going by SKILL.md and its folder, Security Audit needs the command-line tools its instructions call (npm, uv and cargo). Our summary lists: Python 3. Its frontmatter pre-approves these tools: Read, Grep, Glob, Bash, WebSearch, WebFetch, Agent.
Does Security Audit access the network?
SKILL.md contains no URLs. Its commands use npm and uv, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Security Audit safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file; pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Security Audit use?
Security Audit has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Security Audit use?
About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Audit?
Skills that share tags, products or a category with Security Audit: Security Reviewer (Jeffallan/claude-skills, 12k stars), Security Audit (staruhub/ClaudeSkills, 727 stars), Security Scan (ericrisco/rsc-harness, 167 stars) and Security Auditor (eigent-ai/eigent, 15k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Audit?
Aedelon (a GitHub user) maintains it in Aedelon/claude-code-blueprint, which has 120 GitHub stars. The repository holds 8 skills in this directory. The repository was last updated on March 4, 2026.
Source: Aedelon/claude-code-blueprint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.